Thai Gambling SEO Poisoning Hijacked 163 Organizations’ Abandoned DNS Delegations

Researchers reported a large-scale SEO poisoning campaign that hijacked abandoned cloud DNS delegations to publish Thai-language gambling pages on legitimate corporate subdomains belonging to 163 organizations in more than 30 countries. The activity primarily abused orphaned Azure DNS zones, though investigators also observed stale configurations involving DigitalOcean, wildcard misconfigurations, and a Verizon-linked cluster with more than 1,000 deceptive A records. Victims included government agencies, hospitals, banks, universities, and critical infrastructure providers, and 161 of the 163 organizations were still actively compromised when the findings were published.

The operators reclaimed forgotten DNS zones, added wildcard or bulk DNS records, obtained valid Let’s Encrypt wildcard certificates, and deployed a consistent Next.js gambling kit that made the pages appear trustworthy to users, browsers, and search engines. Investigators linked the infrastructure through shared favicons, redirect paths, certificates, JARM fingerprints, HTTP body hashes, and Chinese-language management artifacts, tracing delivery nodes and a 103-server backend network in Hong Kong that supported affiliate gambling domains and referral codes such as link99, ibiza99vip1, bigwinv1, and seven77vip1. The campaign relied on DNS hygiene failures rather than malware or application exploits, with server-side geographic filtering used to redirect Thai users to gambling destinations.